CVE-2026-42997: openstack ironic
Vulnerability summary
CVE-2026-42997 is a high (CVSS 7.7) vulnerability in openstack ironic. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.4% of scored vulnerabilities.
Timeline
- 05-05-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · PypiEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · Red hatEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- NVDNIST7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
+0.11 pp
From 0.43% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-669Incorrect Resource Transfer Between SpheresThe product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
- CWE-201Insertion of Sensitive Information Into Sent DataThe code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
Affected systems
Redhat4 products
- openstack-ironic< 1:21.4.5-18.0.20260616204937.9213ccd.el9ost
- openstack-ironic-api< 1:21.4.5-18.0.20260616204937.9213ccd.el9ost
- openstack-ironic-common< 1:21.4.5-18.0.20260616204937.9213ccd.el9ost
- openstack-ironic-conductor< 1:21.4.5-18.0.20260616204937.9213ccd.el9ost
Debian1 product
- ironic< 1:21.1.0-3+deb12u1 | < 1:29.0.5-0+deb13u1 | < 1:35.0.1-1
Openstack1 product
- ironic≥ 17.0.0, < 26.1.6 | ≥ 27.0.0, < 29.0.5 | ≥ 30.0.0, < 32.0.1 | ≥ 33.0.0, < 35.0.1
PyPI1 product
- ironic-python-agent≥ 30.0.0, < 32.0.1 | ≥ 27.0.0, < 29.0.5 | < 26.1.6 | ≥ 33.0.0, < 35.0.1
Ubuntu1 product
- ironicAll versions (No fix recorded)
5 vendors · 8 products
References
17 links- www.openwall.com/lists/oss-security/2026/05/05/10WEBARTICLEREPORTMailing ListPatchThird Party Advisory
